KEMENTERIAN PERHUBUNGAN

DIREKTORAT JENDERAL PERHUBUNGAN UDARA

PERATURAN DIREKTUR JENDERAL PERHUBUNGAN UDARA

NOMOR : KP 277 TAHUN 2017

TENTANG

PETUNJUK TEKNIS

PERATURAN KESELAMATAN PENERBANGAN SIPIL BAGIAN 19-03

{STAFF INSTRUCTION 19-03)

PROGRAM ANALISIS DATA PENERBANGAN

(FLIGHT DATA ANALYSIS PROGRAM]

DENGAN RAHMAT TUHAN YANG MAHA ESA

DIREKTUR JENDERAL PERHUBUNGAN UDARA,

Menimbang : a. bahwa pada butir 19.65 dalam Lampiran Peraturan

Menteri Perhubungan Republik Indonesia Nomor

PM 62 Tahun 2017 tentang Peraturan Keselamatan

Penerbangan Sipil Bagian 19 [Civil Aviation Safety

Regulations Part 19) tentang Sistem Manajemen

Keselamatan (Safety Management System) telah

mengatur bahwa setiap penyedia jasa penerbangan

terutama operator pesawat udara harus menyusun

program analisis data penerbangan sebagai bagian dari

sistem manajemen keselamatan;

b. bahwa perlu disusun petunjuk teknis yang digunakan

oleh Direktorat Jenderal Perhubungan Udara dalam

mengawasi implementasi program analisis data

penerbangan sebagaimana dimaksud pada huruf a;

c. bahwa berdasarkan pertimbangan sebagaimana

dimaksud dalam huruf a dan huruf b, perlu

menetapkan Peraturan Direktur Jenderal Perhubungan

Udara Tentang Petunjuk Teknis Peraturan

Keselamatan Penerbangan Sipil Bagian 19-03 (Staff

Instruction 19-03) Program Analisis Data Penerbangan

(Flight Data Analysis Program);

Mengingat : 1. Undang-Undang Nomor 1 Tahun 2009 tentang

Penerbangan (Lembaran Negara Republik Indonesia

Tahun 2009 Nomor 1, Tambahan Lembaran Negara

Republik Indonesia Nomor 4956);

2. Peraturan Presiden Nomor 7 Tahun 2015 tentang

Organisasi Kementerian Negara (Lembaran Negara

Republik Indonesia Tahun 2015 Nomor 8);

3. Peraturan Presiden Nomor 40 Tahun 2015 tentang

Kementerian Perhubungan (Lembaran Negara Republik

Indonesia Tahun 2015 Nomor 75);

4. Peraturan Menteri Perhubungan Nomor PM 189 Tahun

2015 tentang Organisasi dan Tata Kerja Kementerian

Perhubungan (Berita Negara Republik Indonesia Tahun

2015 Nomor 1844) sebagaimana telah beberapa kali

diubah, terakhir dengan dengan Peraturan Menteri

Perhubungan Nomor PM 44 Tahun 2017 tentang

Perubahan Kedua atas Peraturan Menteri

Perhubungan Nomor PM 189 Tahun 2015 tentang

Organisasi dan Tata Kerja Kementerian Perhubungan

(Berita Negara Republik Indonesia Tahun 2017 Nomor

816);

5. Peraturan Menteri Perhubungan Nomor PM 62 Tahun

2017 tentang Peraturan Keselamatan Penerbangan

Sipil Bagian 19 (Civil Aviation Safety Regulations Part

19) tentang Sistem Manajemen Keselamatan (Safety

Management System) (Berita Negara Republik

Indonesia Tahun 2017 Nomor 1098);

MEMUTUSKAN:

Menetapkan : PERATURAN DIREKTUR JENDERAL PERHUBUNGAN

UDARA TENTANG PETUNJUK TEKNIS PERATURAN

KESELAMATAN PENERBANGAN SIPIL BAGIAN 19-03

(STAFF INSTRUCTION 19-03) PROGRAM ANALISIS DATA

PENERBANGAN (FLIGHT DATA ANALYSIS PROG

Pasal 1

Memberlakukan Petunjuk Teknis Peraturan Keselamatan

Penerbangan Sipil Bagian 19-03 (Staff Instruction 19-03)

Program Analisis Data Penerbangan (Flight Data Analysis

Program) sebagaimana tercantum dalam Lampiran yang

merupakan bagian tak terpisahkan dari Peraturan Direktur

Jenderal ini.

Pasal 2

Direktur Jenderal Perhubungan Udara melakukan

pengawasan terhadap pelaksanaan Peraturan ini.

Pasal 3

Peraturan ini mulai berlaku sejak tanggal ditetapkan.

Ditetapkan di Jakarta

pada tanggal 5OKTOBER2017

DIREKTUR JENDERAL PERHUBUNGAN UDARA

ttd

Dr. Ir. AGUS SANTOSO, M.Sc

Salinan sesuai aslinyav KEPALA BAGIAN HUKUM

<* <^mm^_^*>5iO^"^

ENDAH PURNAMA SARI

Pembina/ (IV/ a)

xpfi&.yj680704 199503 2 001

LAMPIRAN PERATURAN DIREKTUR JENDERAL PERHUBUNGAN UDARANOMOR : KP 277 TAHUN 2017TANGGAL : 5 Oktober 2017

Staff Instruction

SI 19 - 03

Flight Data Analysis Program

Edition

Amendment

Date

1

0

REPUBLIC OF INDONESIA - MINISTRY OF TRANSPORTATION

DIRECTORATE GENERAL OF CIVIL AVIATION

JAKARTA - INDONESIA

SI 19-03

AMENDMENT RECORD LIST

Amendment

No.Issue Date Inserted By Insertion Date

Original

1. PURPOSE

2. REFERENCES

3. CANCELLATION

4. AMENDMENT

SI 19 - 03

FOREWORD

This Staff Instruction prescribes responsibilities,policies, and procedures to be used by the DirectorateGeneral of Civil Aviation for conducting monitoring ofthe implementation of flight data analysis program byair operator. This Staff Instruction may be madeavailable to the public so that they may betterunderstand the authority and responsibilities of DGCA.

This Staff Instruction should be used in accordancewith the applicable regulations.

The amendment of this Staff Instruction is approved byDirector General of Civil Aviation.

DIRECTOR GENERAL OF CIVIL AVIATION

ttd

Dr. Ir. AGUS SANTOSO, M.Sc.

Salinan sesuai aslinya

, KEPALA BAGIAN HUKUM

ENDAH PURNAMA SARI• , '

Pembina/(IV/a)NIP. 19680704 199503 2 001

ii

SI 19-03

TABLE OF CONTENTS

AMENDMENT RECORD LIST i

FOREWORD ii

TABLE OF CONTENTS iii

ACRONYMS AND ABBREVIATIONS iv

CHAPTER 1 INTRODUCTION 1

1. BACKGROUND 1

2. OBJECTIVES AND SCOPE 1

3. FLIGHT DATA ANALYSIS PROGRAMME 2

CHAPTER 2 FLIGHT DATA ANALYSIS PROGRAMME DESCRIPTION 6

1. FDAP OVERVIEW 6

2. FDA EQUIPMENT 6

3. PROCESSING FDA DATA 9

4. ANALYSIS AND FOLLOW-UP 11

CHAPTER 3 PREREQUISITES FOR AN EFFECTIVE FDAP 13

1. PROTECTION OF FDA DATA 13

2. INVOLVEMENT OF FLIGHT CREWS 15

3. SAFETY CULTURE 15

CHAPTER 4 ESTABLISHING AND IMPLEMENTING AN FDAP 17

1. IMPLEMENTATION PLAN 17

2. AIMS AND OBJECTIVES 18

3. FDAP TEAM 19

4. CONTINUOUS IMPROVEMENT 20

CHAPTER 5 FDAP SURVEILLANCE 22

1. BACKGROUND AND OBJECTIVES 22

2. FORMS/CHECKLIST 25

in

ACRONYMS AND ABBREVIATIONS

ACAS Airborne collision avoidance system

ADRS Aircraft data recording system

ASR Air safety report

ATC Air traffic control

Doc Document

FDA Flight data analysis

FDAP Flight data analysis programme

FDAPM Flight Data Analysis Programme Manual

FDR Flight data recorder

FOQA Flight operations quality assurance

GPWS Ground proximity warning system

LOSA Line operations safety audit

QAR Quick access recorder

SDCPS Safety data collection and processing system

SOP Standard operating procedures

SMM Safety Management Manual

SMS Safety management system(s)

SI 19 - 03

IV

SI 19 - 03

CHAPTER 1 INTRODUCTION

1. BACKGROUND

Initially, the principal use of flight recorders was to assist accident/incident

investigators, especially in those accidents with no surviving crew members.

It was recognized that analysis of the recorded data was also useful for

better understanding of safe operations. By routinely accessing the recorded

flight parameters, much could be learned about the safety of flight

operations and the performance of airframes and engines. Valuable data on

what goes right in day-to-day operations were available, putting accident

and incident data into perspective. As well, analysis of this de- identified

data could assist in the predictive identification of safety hazards before an

incident or accident occurred.

To capitalize on these benefits, a number of operators set up systems to

routinely analyze recorded flight data. The aviation industry is increasingly

analyzing recorded data from normal operations in support of organizations'

safety management systems (SMS). Flight data analysis (FDA) has provided

management with another tool for proactively identifying safety hazards,

and controlling and mitigating the associated risks.

Outlining the requirements for establishing and maintaining a flight data

analysis programme (FDAP) refer to CASR Part 19. This material has been

incorporated into this manual in order to highlight the importance of

establishing an FDA programme (FDAP).

2. OBJECTIVES AND SCOPE

This manual is addressed to DGCA providing oversight to air operators as

well as air operators performing commercial air transport operations with

airplanes and helicopters.

The objective of this manual is to provide:

1) a description of the relationship between SMS and FDAP;

2) an overview of FDAP elements; and

3) guidance for the establishment and implementation of an FDAP.

IV

SI 19-03

FLIGHT DATA ANALYSIS PROGRAMME

FDA, sometimes referred to as flight data monitoring or flight

operational quality assurance (FOQA), provides a systematic tool for the

proactive identification of hazards. FDA is a complement to hazard and

incident reporting and to a line operations safety audit (LOSA).

CASR Part 1 defines "flight data analysis" as a process of analysing

recorded flight data in order to improve the safety of flight operations.

An FDAP may be described as a non-punitive programme for routine

collection and analysis of flight data to develop objective and predictive

information for advancing safety, e.g. through improvements in flight crew

performance, training effectiveness, operational procedures, maintenance

and engineering, and air traffic control (ATC) procedures.

FDA involves:

(a) capturing and analysing flight data to determine if the flight deviated

from a safe operating envelope;

(b) identifying trends; and

(c) promoting action to correct potential problems.

Periodically, flight data are transferred from the aircraft and analysed by

the ground analysis system at a centralized location.

Deviations of more than certain predetermined values, called

"exceedances", are flagged and evaluated. The FDA team will propose and

evaluate corrective actions, as well as produce exceedances aggregation

over time to determine and monitor trends. FDA also allows for early

identification of aircraft system degradation for maintenance action.

Objectives of a flight data analysis programme

FDAPs are increasingly being used for the monitoring and analysis of

flight operations and engineering performance. They are a mandatory

type of safety data collection and processing system (SDCPS) of the SMS

for operators of airplanes of a maximum certificated take-off mass in

excess of 27 000 kg, and an advisable component for those that are below

that mass threshold. Successful FDAPs encourage adherence to standard

operating procedures (SOPs), and determine non-standard behavior,

thereby improving safety performance. They can detect adverse trends in

any part of the flight regime and thus facilitate the investigation of

events, including those which have had serious consequences.

IV

SI 19 - 03

Flight data analysis can be used to identify non-standard or deficient

procedures, weaknesses in the air traffic control (ATC) system and

anomalies in aircraft performance. FDA allows the monitoring of various

aspects of the flight profile, such as the adherence to the prescribed

take-off, climb, cruise, descent, approach and landing SOPs. Specific

aspects of flight operations can be examined either retrospectively to

identify problem areas, or proactively prior to introducing operational

change, and subsequently to confirm the effectiveness of the change.

During incident analysis, flight data of the related flight can be compared

with the fleet profile data, thereby facilitating analysis of the systemic

aspects of an incident. It may be that the parameters of the incident-flight

vary only slightly from many other flights, possibly indicating a

requirement for change in operating technique or training. For example,

it would be possible to determine whether a tail-scrape on landing was an

isolated event, or symptomatic of a wider mishandling problem, such as

over-flaring on touchdown or improper thrust management.

Engine monitoring programmes may utilize FDAP data for reliable trend

analysis, as manually coded engine data are limited in terms of accuracy,

timeliness and reliability. It is also possible to monitor other aspects of the

airframe and systems.

In summary, FDAPs offer a wide spectrum of applications for safety

management. Furthermore, it also offers the benefit of improving

operational efficiency and economy that compensate the needed

investment. The objective is to:

(a) determine operating norms;

(b) identify potential and actual hazards in operating procedures, fleets,

aerodromes, ATC procedures, etc.;

(c) identify trends;

(d) monitor the effectiveness of corrective actions taken;

(e) provide data to conduct cost-benefit analyses;

(f) optimize training procedures; and

(g) provide actual rather than presumed performance measurement for risk

management purposes.

(h) It is important that FDAPs are non-punitive and contain adequate

safeguards to protect the source(s) of the data.

IV

SI 19-03

A flight data analysis programme integrated within a safety management

system.

FDA aims at continuous improvement of the overall safety performance of

an operator and it should be integrated in the safety assurance component

of the operator's SMS. Ideally, where multiple systems are utilized to identify

hazards and manage risk, they should be integrated to maximize their

combined effectiveness, to ensure resources are being distributed

appropriately across the systems and, where possible, to reduce duplicated

processes for greater system efficiency. So, an operator wishing to

implement an FDAP and which already has mature SMS processes in place

should be able to readily adopt and understand the fundamental processes

of an FDAP.

For example, as part of an operator's SMS safety assurance processes, an

FDAP will have identified indicators or parameters chosen for measuring

and monitoring the operator's safety performance, including "operational

events". These events may be low consequence (deviation, non-compliance

events) or high consequence safety performance indicators (accident and

serious incident rates). Such data are routinely fed into or part of the

SDCPS.

The operator's SMS assurance processes would also have procedures for

corrective or follow-up action to be taken when targets are not achieved

and/or alert levels are breached that are set for each of the performance

indicators / parameters.

Alert and target levels serve as markers to define what are the

abnormal/unacceptable occurrence rate as well as the desired target

(improvement) rate for the indicator. The alert level for a particular safety

indicator is the demarcation line between the acceptable trending region

and the unacceptable region. Target level setting is the desired improvement

level within a defined future milestone or monitoring period. With such

defined alert and target settings, it becomes apparent that a

qualitative/quantitative performance outcome can be derived at the end of

any given monitoring period. This may be done by counting the number of

alert breaches and/or the number of targets achieved for an individual

indicator and/or a package of safety indicators. Further guidance on setting

alert and target levels can be found in the Staff Instruction 8900-15.3,

Safety Management System.

IV

SI 19-03

Under such an assurance programme, the management would also be

responsible for setting procedures to review new and existing aviation

safety-related facilities and equipment, including operations and processes

for hazards/risks before they are established or when changes to operations

are introduced.

The FDA specific data output could be easily integrated into existing

databases for measuring safety performance, managing change and

continuous improvement. Such cross-communication between an FDAP and

SMS would increase the robustness of the processes and help achieve

greater effectiveness in safety and quality of the system/programme.

Where an FDAP is in place but not integrated in the SMS, the operator will

need to develop the processes to assure effective means of safety

performance measurement and corrective action plans in order to maintain

continuous improvement of the operations.

An FDAP held remote from the SMS of an operator would cause a

substandard performance of the SMS for its continuous improvement.

Moreover, information from other SMS data sources gives context to the

flight data which will, in return, provide quantitative information to support

analysis that otherwise would be based on subjective reports. Air safety

reporting, avionic and systems maintenance, engine monitoring, ATC and

scheduling are just a few of the areas that could benefit.

The degree of integration between an operator's SMS and its FDAP will

depend on many factors, including the relative maturity of the two systems

as well as operational, organizational and regulatory considerations.

IV

SI 19 - 03

CHAPTER 2 FLIGHT DATA ANALYSIS PROGRAMME DESCRIPTION

1. FDAP OVERVIEW

The quality and capability of an operator's FDAP will be dependent on the

selection, availability of flight parameters, and the quick access recorder's

(QAR's) availability. The selected flight parameters should be relevant and

appropriate to reflect the safety, quality or risk level of the process thereby

providing a performance track. It is important to note that the programme

description herewith provides baseline components. Therefore, depending

on availability of resources, technology, complexity and size of operation,

the programme will need to be modified to suit the needs of the operator.

2. FDA EQUIPMENT

FDAPs generally involve systems that capture flight data, transform the

data into an appropriate format for analysis, for generating reports and for

visualization to assist in assessing the data. The level of sophistication of

the equipment can vary widely. Typically, however, the following equipment

capabilities are required for effective FDAPs:

1) an on-board device to capture and record data on a wide range of

flight parameters. These flight parameters should include, but not

be limited to, the flight parameters recorded by the flight data

recorder (FDR) or aircraft data recording systems (ADRS). The flight

parameter performance (range, sampling rate, accuracy, recording

resolution) should be as good as or better than the performance

specified for FDR parameters;

2) a means to transfer the data recorded on board the aircraft to a

ground-based processing station. In the past, this largely involved the

physical movement of the memory unit from the QAR. To reduce the

physical effort required, more modern transfer methods utilize wireless

technologies;

3) a ground-based computer system (using specialized software) to

analyse the data (from single flights and/or in an aggregated format),

identify deviations from expected performance, generate reports to

assist in interpreting the read-outs, etc.; and

IV

SI 19 - 03

4) optional software for a flight animation capability to integrate alldata, presenting it as a simulation of in-flight conditions, therebyfacilitating visualization of actual events for analysis and crew

debriefing.

Airborne equipment

Modern glass-cockpit and fly-by-wire aircraft are equipped with thenecessary digital data-buses from which information can be captured by arecording device for subsequent analysis. Older, non-digital, aircraft arecapable of capturing a limited set of data, but may be retrofitted torecord additional parameters. Nevertheless, a limited parameter set will

allow for a useful, basic FDAP.

The flight parameters recorded by the FDR or ADRS may determine aminimum set for an FDAP. In some cases, the flight parameters and

FDR/ADRS recording duration required by law to support accident andincident investigations may be insufficient to support a comprehensiveFDAP. Thus, many operators are opting for additional recording capacity,

capable of being easily downloaded for analysis.

QARs are optional non-crash protected recorders installed on the aircraft

and record flight data in a low- cost removable medium. They are more

accessible and record the same parameters for a longer duration than the

FDR. New technology QARs and new flight data acquisition systems offer

the possibility to capture and record thousands of flight parameters. Theyalso allow for increasing the sampling rate or the recording resolution of

specific flight parameters to values appropriate for advanced flight dataanalysis. The expanded data frame greatly increases the resolution andaccuracy of the output from ground analysis programmes. However, thedata frame definition is one of the more difficult parts of setting up an

FDAP. For example, in a mixed fleet, it is very expensive to obtain the

necessary capability to read different data sets.

An increasing number of aircraft are being fitted with light-weight flight

recorders as standard equipment; these units will provide a source of

flight data for operators of smaller aircraft. This will enable suchoperators to implement an FDAP commensurate with the size of their

operations even if there are no provisions requiring them to institute

FDAPs. The light-weight recorders make use of low-cost removable

IV

SI 19-03

memory cards which may simplify the process to download and analyse

the flight data.

To eliminate the task of moving the data from the aircraft to the ground

station by physically removing the recording medium of the QAR, newer

systems automatically download the recorded information via secure

wireless systems when the aircraft is in the vicinity of the gate. In other

systems, the recorded data is analysed on board while the aircraft is

airborne. The relevant encrypted data are then transmitted to a ground

station using satellite communications. Fleet composition, route

structure and cost considerations will determine the most cost-effective

method of removing the data from the aircraft.

Ground-based computer system for flight data analysis

Flight data are downloaded from the aircraft recording device into a

ground-based computer system including analysis software, where the

data are held securely to protect this sensitive information. Such

computer systems are commercially available; however, the computer

platform will require appropriate front-end interfaces to cope with the

variety of recording inputs available today.

FDAPs generate large amounts of data requiring specialized analysis

software. This analysis software facilitates the routine analysis of flight

data in order to identify situations that may require corrective action.

The analysis software checks the downloaded flight data for

abnormalities. The exceedance detection typically includes a large number

of trigger logic expressions derived from a variety of sources such as flight

performance curves, SOPs, engine manufacturers' performance data,

airfield layout and approach criteria. Trigger logic expressions may be

simple exceedances such as redline values. The majority, however, are

composites which define a certain flight mode, aircraft configuration or

payload-related condition. Analysis software can also assign different sets

of rules dependent on aerodrome or geography. For example, noise

sensitive aerodromes may use higher than normal glide slopes on

approach paths over populated areas. The set of trigger logic expressions is

normally user-defined.

Exceedances and routine measurements can be displayed on a ground

computer screen in a variety of formats. Recorded flight data are usually

shown in the form of color-coded traces and associated engineering

IV

SI 19 - 03

listings, cockpit simulations or animations of the external view of the

aircraft.

PROCESSING FDA DATA

Exceedance detection

Exceedance detection, such as deviations from flight manual limits or

SOPs, is one way of extracting information from flight data. A set of core

events/parameters establishes the main areas of interest to an operator.

Examples: High lift-off rotation rate, stall warning, ground proximity

warning system (GPWS) warning, flap limit speed exceedance, fast

approach, high/low on glide slope and heavy landing.

Exceedance data provides factual information which complement crew and

engineering reports.

Examples: Reduced flap landing, hard landings, emergency descent,

engine failure, rejected take-off, go-around, airborne collision avoidance

system (ACAS) or GPWS warning and system malfunctions.

Operators may also modify the standard set of core events to account for

unique situations they regularly experience or for the SOPs they use.

Routine measurements

Data can be retained from all flights, not just those producing significant

events. A selection of parameters is retained that is sufficient to

characterize each flight and allow a comparative analysis of a wide range

of operational variability. Emerging trends and tendencies are monitored

before the trigger levels associated with exceedances are reached.

Examples of flight parameters monitored: Take-off weight; flap setting;

temperature; rotation and lift-off speeds versus scheduled speeds;

maximum pitch rate and attitude during rotation; and gear retraction

speeds, heights and times.

Examples of comparative analyses: pitch rates from high versus low take-off

weights; unstable approaches; and touchdowns on short versus long

runways.

IV

SI 19-03

Incident investigation

FDAPs provide valuable information for incident investigations and for

follow-up of other technical reports. Quantifiable recorded data have been

useful in adding to the impressions and information recalled by the flight

crew. FDAP data also provide an accurate indication of system status and

performance, which may help in determining cause and effect relationships.

Examples of incidents where recorded flight data could be useful: High

cockpit workload conditions as corroborated by such indicators as:

1) late descent;

2) late localizer and/or glide slope interception;

3) large heading change below a specific height;

4) late landing configuration;

5) unstabilized and rushed approaches, glide path excursions, etc.;

6) exceedances of prescribed operating limitations (such as flap limit

speeds, engine over-temperatures); and

7) Wake vortex encounters, low-level wind shear, turbulence encounters

or other vertical accelerations.

Continuing airworthiness

Both routine measurements and exceedances can be utilized to assist the

continuing airworthiness function. For example, engine-monitoring

programmes look at measures of engine performance to determine

operating efficiency, predict impending failures and assist in maintenance

scheduling.

Examples of continuing airworthiness uses: Engine thrust level and airframe

drag measurements; avionics and other system performance monitoring;

flight control performance; monitoring "on-condition" systems and engine

deterioration; and brake and landing gear usage.

Integrated safety analysis

All the data gathered in an FDAP should be integrated in a central safety

database. By linking an FDAP database to other safety databases (such as

incident reporting systems and technical fault reporting systems), a more

complete understanding of events becomes possible through cross-

referencing the various sources of information. Care should be taken,

however, to safeguard the confidentiality of FDA data when linking the data

to identified data.

iv

SI 19-03

Example of integration: A heavy landing results in a flight crew report, an

FDA exceedance and an engineering report. The flight crew report provides

the context, the FDA exceedance provides the quantitative description and

the engineering report provides the result.

4. ANALYSIS AND FOLLOW-UP

Overviews and summaries of FDA data are compiled on a regular basis,

usually weekly or bi-weekly, whilst individual significant events would be

expected to be more timely followed up. All data should be reviewed to

identify specific exceedances and emerging undesirable trends and to

disseminate the information to flight crews.

If deficiencies in the flight technique are recognized, the information is de-

identified in order to protect the identity of the flight crew. The information

on specific exceedances is passed to a flight crew contact person. This

person provides the necessary contact with the flight crew (see 4.3 "The

FDAP team") in order to clarify the circumstances, obtain feedback and

give advice and recommendations for appropriate action, such as flight

crew re-training (carried out in a positive and non-punitive way),

revisions to operating and flight manuals or changes to ATC and

aerodrome operating procedures.

All events are archived in a database. The database is used to sort, validate

and display the data in easy- to-understand management reports. Over

time, this archived data can provide a picture of emerging trends and

hazards which would otherwise go unnoticed.

Lessons learned from an FDAP may warrant inclusion in the company's

safety promotion activities. Care is required, however, to ensure that any

information acquired through FDA is de-identified before using it in any

training or promotional initiative unless permission is given by all the

crew members involved. Care should also be taken that, in order to avoid

an exceedance, flight crews do not attempt to "fly the FDA profile" rather

than follow SOPs. Such behavior would have a negative impact on safety.

A proper value should be programmed for trigger and exceedance and

designed to include an acceptable buffer that will disregard minor

deviation, spurious events, as well as introduce an adequate operational

margin to fly the aeroplane through SOPs, instead of leading the flight crew

to focus on FDA parameters in order to avoid deviations.

IV

SI 19 - 03

As in any closed-loop process, follow-up monitoring is required to assess

the effectiveness of any corrective actions taken. Flight crew feedback is

essential for the identification and resolution of safety problems and

could include answering the following example questions:

1) Is the implementation and effectiveness of corrective actions adequate?

2) Are the risks mitigated, or unintentionally transferred to another part of

the operations?

3) Have new problems been introduced into the operation as a result of

implementing corrective actions?

All successes and failures should be recorded, comparing planned

programme objectives with expected results. This provides a basis for

review of an FDAP and the foundation for future programme development.

IV

SI 19 - 03

CHAPTER 3 PREREQUISITES FOR AN EFFECTIVE FDAP

1. PROTECTION OF FDA DATA

Overall approach

The operator's management, flight crews and the DGCA have legitimate

concerns regarding the protection of FDA data, which include:

1) use of data for disciplinary purposes;

2) use of data for enforcement actions against individuals or against the

company, except in cases of criminal intent or willful misconduct;

3) disclosure to the media and the general public under the provisions of

State laws regarding access to information; and

4) disclosure during civil litigation.

However, the integrity of an FDAP rests upon protection of the FDA data.

Any disclosure for purposes other than safety management can

compromise the required cooperation of the affected flight crew in

clarifying and documenting an event. Thus, preventing the misuse of FDA

data is a common interest of the State, the operator and the flight crews.

Data protection can be optimized by:

1) adhering to the agreement between management and the flight crews,

where available;

2) strictly limiting data access to selected individuals;

3) maintaining tight control to ensure that data identifying a specific flight

are kept secure;

4) ensuring that operational problems are promptly addressed by

management; and

5) to the extent possible, non-reversible de-identification of the flight data

files after a time appropriate for their analysis.

Policy on retention of data

Because of the large volumes of data involved, it is important that a

strategy for data access, both online and offline, is carefully developed to

meet the needs of FDAP users.

13

SI 19-03

The most recent flight data and exceedances are normally kept readily

available to allow fast access during the initial analysis and interpretation

stages. When this process is completed, it is less likely that additional data

from the flights will be required so the flight data can be archived.

Exceedances are usually kept online for a much longer period to allow

trending and comparison with previous events.

De-identification policy and procedures

A policy on FDA data de-identification is an absolutely critical area that

should be carefully written down and agreed to before it is needed in

extreme circumstances. Management assurance on the nondisclosure of

individuals must be very clear and binding. The one exception is when the

operator/flight crew believes that there is a continuing unacceptable safety

risk if specific action regarding the flight crew is not taken. In this case,

an identification and follow-up action procedure, previously agreed to

before the particular event, can be brought into play. Experience has

shown that this is very rarely required. Most often a flight crew responds

to advice from the FDA flight crew contact person to submit an air safety

report (ASR) and they may then be covered by protection assured under that

programme.

There should be an initial stage during which the data can be identified to

allow confidential follow-up by the crew representative or trusted individual

agreed to by the operator and the flight crews. Strict rules of access should

be enforced during this period. In the case of a mandatory occurrence or

accident, any data retained by the programme may not be de-identified or

removed from the system prior to the investigation or for confirmation that

it is not required. This will allow the safety investigators access to all

relevant information.

Set authorized access levels

The FDA ground-based computer system must have the ability to restrict

access to sensitive data and also control the ability to edit data. For

example, the FDA flight crew contact person could have full access, while

operations management would only have access to de-identified data and

the ability to add comments and edit a few appropriate fields.

14

SI 19 - 03

2. INVOLVEMENT OF FLIGHT CREWS

As with successful incident reporting systems, the trust established

between management and its flight crews is the foundation for a

successful FDAP. For most operators this will be accomplished through an

association, while for others civil aviation authority may be the custodian

of flight crew involvement under the limitation of the due "duty of care".

Here it is incumbent upon management to provide assurance of the FDAP

intent, conditions of use and protection given to its employees. This trust

can be facilitated by:

1) early participation of the flight crew representatives and/or

authority representatives in the design, implementation and

operation of an FDAP; and

2) a formal agreement between management and the flight crews, and/or

authority identifying the procedures for the use and protection of data.

3. SAFETY CULTURE

Consistent and competent programme management characterizes

successful FDAPs. Indications of an effective safety culture of an operator

include:

1) top management's demonstrated commitment to promoting a proactive

safety culture;

2) the cooperation and accountability of all organizational levels and

relevant personnel representatives, meaning that anyone believing to

have identified a potential risk should feel able to report and expect

follow-up action to be considered. From the line pilot to the fleet

manager all have responsibility to act;

3) a written non-punitive company policy that covers FDA and makes

clear that the main objective of an FDAP should be to improve safety,

and not to allocate blame or liability;

4) an identified safety manager whose role and functions are defined

following the recommendations of the SI 8900-15.3, Safety

Management System;

5) FDAP management by a dedicated staff under the authority of the

safety manager, with a high degree of specialization and logistical

support;

6) Involvement of persons with appropriate expertise when identifying and

assessing risks. For example, flight crews experienced on the aircraft

type being analyzed are required for the accurate diagnosis of15

SI 19-03

operational hazards emerging from FDA analyses;

7) A focus on monitoring fleet trends aggregated from numerous

operations, rather than on specific events. The identification of

systemic issues adds more value for safety management than isolated

events;

8) a well-structured de-identification system to protect the confidentiality

of the data; and

9) an efficient communication system, to permit timely safety action, for

disseminating hazard information and subsequent risk assessments

internally and to other organizations.

16

SI 19 - 03

CHAPTER 4 ESTABLISHING AND IMPLEMENTING AN FDAP

1. IMPLEMENTATION PLAN

Typically, the following steps are required to implement an FDAP:

1) management approval of the programme;

2) implementation of a formal agreement between management and flight

crews;

3) identification of an FDAP implementation committee, including the

future FDA team members; this committee should be involved in all

of the following steps;

4) development of a business plan, including processes, software and

hardware and assignment of adequate resources;

5) establishment and verification of operational and security procedures;

6) development of an FDAP procedures manual;

7) assessment of possible interfaces between an FDAP and other safety

data sources (i.e. SDCPS) and of integration of an FDAP into the SMS;

8) selection of equipment (airborne, ground-based computer system,

interface with other data sources and the SMS);

9) selection and training of the FDA team members, according to their

respective roles;

10) testing of data transfer; testing of the ground-based computer

system (including data acquisition, definition of trigger logic

expressions, data analysis and visualization, data de-identification,

final storage of data);

11) testing of data security, including security procedures;

12) identification of areas of interest that should be first looked at in the

data;

13) checking of the proper decoding and of the quality of flight parametersused by an FDAP; and

14) start of data analysis and validation, focused on key areas inoperation.

Historically, bearing in mind the time required to obtain flight

crew/management agreements and develop relevant procedures, an

operator with no FDA experience would not likely achieve an operational

FDAP in less than twelve months. Another year may be required before

any safety and cost benefits appear. Improvements in the analysis

17

SI 19 - 03

software, or the use of outside specialist service providers, should shorten

these time frames to ensure FDA coverage during the safety-critical period

of introduction to service.

2. AIMS AND OBJECTIVES

A phased approach is recommended so that the foundations are in place

for possible subsequent expansion into other areas. Using a building

block approach will allow expansion, diversification and evolution through

experience.

Example: With a modular system, begin by looking at basic safety-related

issues only. Add engine health monitoring, etc. in the second phase.

Ensure compatibility with other systems.

A staged set of objectives starting from the first week's replay and moving

through early production reports into regular routine analysis will

contribute to a sense of achievement as milestones are met.

Examples:

1) Short-term goals:

a) establish data download procedures, test analysis software and

identify aircraft defects;

b) validate and investigate exceedance data; and

c) establish a user-acceptable routine report format to highlight

individual exceedances and facilitate the acquisition of relevant

statistics.

2) Medium-term goals:

a) produce annual report — include key performance indicators;

b) add other modules to analysis (e.g. continuing airworthiness);

and

c) plan for the next fleet to be added to the programme.

3) Long-term goals:

a) network FDA information across all company safety information

systems and integrate an FDAP into the SMS;

b) ensure FDA provision for any proposed advanced trainingprogramme; and

c) use utilization and condition monitoring to reduce spares

holdings.

Initially focusing on a few known areas of interest will help prove the

system's effectiveness.

18

SI 19 - 03

Examples: Rushed approaches, or rough runways at particularaerodromes; unusual fuel usage on particular flight segments, etc.

Analysis of such known problem areas may generate useful operational

confidence leading to the analysis of other areas.

FDAP TEAM

Experience has shown that the "team" required running an FDAP canvary in size from one person for a small fleet, to a dedicated section forlarge fleets. The descriptions below identify various functions to be fulfilled,

not all of which need a dedicated position.

1) Team leader. It is essential that the team leader earns the trust andfull support of both management and flight crews. He/she acts

independently of others in line management to make

recommendations that will be seen by all to have a high level of

integrity and impartiality. The individual requires good analytical,

presentation and management skills. He/she should be the safety

manager or placed under the authority of the safety manager.

2) Flight operations interpreter. This person is usually an experienced

pilot in the type and operation who knows the operator's route

network and aircraft. This team member's in-depth knowledge of

SOPs, aircraft handling characteristics, airports and routes will be

used to place the FDA data in a credible context.

3) Technical interpreter. This person interprets FDA data with respect

to the technical aspects of the aircraft operation and is familiar with

the power plant, structures and systems departments' requirements

for information and any other engineering monitoring programmes in

use by the operator.

4) Flight crew contact person. This is a person usually assigned by the

operator for this responsibility (safety manager, agreed flight crew

representative, honest broker), or a mutually acceptable substitute,

for confidential discussion with flight crews involved in events

highlighted by FDA. The position requires good people skills and a

positive attitude towards safety education. The flight crew contact

person should be the only person permitted to connect the identifying

data with the event. The flight crew contact person requires the trust

of both flight crew members and managers for his/her integrity and

good judgement.

19

SI 19 - 03

5) Engineering technical support. This person is usually an avionics

specialist, involved in the supervision of FDR serviceability. Indeed,

an FDAP can be used to monitor the quality of flight parameters sent

both to the FDR and to the FDA recorder, and thus ensure the

continued serviceability of the FDR. This team member should be

knowledgeable about FDA and the associated systems needed to run

the programme.

6) Air safety coordinator. This person cross-references FDA information

with other safety data sources (such as the company's mandatory or

confidential incident reporting programme and LOSA) and with the

operator's SMS, creating a credible integrated context for all

information. This function can reduce duplication of follow-up

investigations.

7) Replay operative and administrator. This person is responsible for

the day-to-day running of the system, producing reports and

analyses. Methodical, with some knowledge of the general operating

environment, this person keeps the programme moving. Operators

may utilize the services of a specialist contractor to operate an

FDAP.

All FDAP team members need appropriate training or experience for their

respective area of data analysis and should be subject to a confidentiality

agreement.

Each team member should be allocated a realistic amount of time to

regularly spend on FDA tasks. With insufficient human resources, the

entire programme will underperform or even fail.

CONTINUOUS IMPROVEMENT

New safety issues identified and published by other organizations, such

as safety investigation reports, safety bulletins by the aircraft

manufacturer or safety issues identified by aviation authorities, should be

assessed for inclusion in a corresponding monitoring activity of an FDAP.

The FDA processes and procedures will need to be amended when an

FDAP matures and each time there are changes in the operations, the

internal organization of the aircraft operator or the interface with other

data sources and processes.

20

SI 19 - 03

In order to assess the general effectiveness of an FDAP, a periodic reviewor an audit may be beneficial. Such a review coulddetermine:

1) if anticipated safety benefits are being realized;2) if the FDA procedures reflect the actual operation of an FDAP, and if

they have been followed;

3) whether the information provided to FDAP users is accurate, timely,and useable; and

4) if the tools employed to collect and present data are still adequateand if other technology would be more effective.

21

SI 19-03

CHAPTER 5 FDAP SURVEILLANCE

1. BACKGROUND AND OBJECTIVES

FDAP is the systematic, pro-active use of digital flight data from routine

operations to improve aviation safety within an intrinsically non-punitive

and just safety culture.

DGCA inspectors shall check the Flight Data Analysis Program of the

operator on a yearly basis. The objectives of the inspections are as follows:

1) Evaluation of the FDAP documentation for completeness and

workability

2) Assess if the FDAP is non-punitive and adheres to just culture best

practices

3) Evaluate if FDAP personnel is sufficiently trained and is able to carryout the tasks

4) Evaluate if the FDAP capture rate ensures that a representable

percentage of the flying program is analyzed

5) Evaluate the FDAP trend reports and ascertain that the operator keeps

to the targets it set itself

6) Evaluate the value of the company FDAP targets and ensure that

continues improvement to the level of safety is ensured

A. Process illustration. The operator's FDAP documentation should

contain a FDAP policy which sets out the overall intentions of the

program. A statement to the effect that FDAP shall be non-punitive is a

key element of this policy. The FDAP policy can also be substituted by

an overall (company) safety policy. Various procedures should be

described in the documentation for each phase of the program

according the check list. If the process is contracted out, there should

be a service level agreement together with the contract. This service

level agreement should stipulate minimum requirements such as a

maximum transcript time for events, maximum time for adjustingparameters and limitation settings, etc.

B. FDAP system. It is important to ascertain which system is being used

to capture the FDAP data. The system determines the amount of

sectors that are recorded in relation to the total number of sectors

flown (number of flights recorded/total amount of flights x 100=

capture rate in %) This percentage is called the "capture rate". If a

22

SI 19-03

wireless connection is used for transferring the data, a reasonable

capture rate will be between 90 and 95%. If a PCMCIA card is used a

capture rate of around 80 and 85% can be expected. If optical disks

are used a capture rate of 65 and 75% can be expected. The important

issue is that the capture rate should ensure a reasonable

representation of the entire flying program. If the capture rate is low, it

does not give a good representation of the flying program and is

therefore unacceptable. Even if the capture rate is acceptable the

inspector needs to ensure that all geographical operating areas are

included in the data for it to be representable for the total flying

program of that fleet. Data loss is often incurred by aircraft that are

operated in remote areas.

Airborne systems and equipment used to obtain data, range from

already installed full Quick access recorders, in modern aircraft with

digital systems, to a basic crash protected recorder in older or less

sophisticated aircraft. The analysis potential of the reduced data set

available in the older aircraft may reduce the safety lessons drawn

from the data. The operator shall ensure that the FDAP use does not

negatively influence the serviceability of equipment required for

accident investigation. Tape based DFDR's should not be used for

regular downloads. It is best practice to include the QAR in the MEL as

a D item. QAR's should not be unserviceable for a long time especially

if this impacts severely on the capture rate.

The management of false events or spurious data and an indication of

how much of the raw data is valid, will give insight in the maturity of

the FDAP system and how well the process is managed and

maintained. Access to all the recorded parameters and to the trigger

events is necessary to adopt the system to the company's procedures

and ensures further validity of the data. Ask if extra parameters were

added and which trigger levels have been adjusted for further

understanding of the maturity level of the system. Ideally all level three

events (most serious events) need to be debriefed to the crew involved.

This should never be done before a flight. If not one hundred percent

of the crew in level three events is debriefed the reason why should be

evaluated and could result in a finding. The target should always be

100%. The use of lower level events ensures that emerging negative

trends are addressed and that hazards are addressed before they end

up as incidents.

23

SI 19 - 03

C. Process for results. This section deals with the processes that are in

place for dealing with the outcome of the FDAP. The gate keeper is the

person with access to the names of the crew. He should assure that

the names are not disclosed. This ensures the system stays n23

punitive. Only in cases of grave misconduct names can be disclosed, n

process for when names can be disclosed must be present. Best

practice indicates de-identified data should be kept for 5 years.

Identified data should be kept for less time since the only purpose it

serves is debriefing the crew.

Trend reports should be prepared regularly. Once a month would be a

good time frame. The FOD should be briefed regularly about the trends

and single events so they can manage their department accordingly.

Graphs should be normalized to ensure growth or seasonal influences

in the flying program are not a factor in the trend. A check should be

carried out to ensure the target for producing trend reports was

adhered to. The FOD should use FDAP data as a starting point for

managing the quality of flying of the crew. Negative trends should be

addressed by management action. Trend reports with graphs that do

not go into detail (events per airport, operating area, time of the day

etc.) may indicate a lack of interest or knowledge of the FOD. This

should be addressed by the FDAP Team. The last two questions in the

TREND section of the check list are also there to establish the

management capabilities of the FOD.

FDAP trend data should also be feedback to the training department

and to the crew.

D. Reference to other data. Processes should be in place to line up

FDAP events with tech log entries to ensure corrective actions by the

Maintenance section. The percentage of FDAP events versus tech log

entries also gives a good indication of the safety culture and the level

of discipline of the crews.

This is the same for the percentage of FDAP events versus the number

of air safety reports that are filled. An unsatisfactory percentage

should be the subject of management action by the FOD. Targets for

these percentages should be set every year to ensure continuous

improvement.

In case of an accident or serious incident processes should be in place

to swiftly secure the data and protect the data.

24

SI 19-03

2. FORMS/CHECKLIST

The forms/checklist to conduct FDAP surveillance are provided in DAAO

Form No. 120-95.

Salinan sesuai aslinya

, KEPALA BAGIAN HUKUM

ENDAH PURNAMA SARI

Pembina/ (IV/ a)

NIP. 19680704 199503 2 001

DIRECTOR GENERAL OF CIVIL AVIATION

ttd

Dr. Ir. AGUS SANTOSO, M.Sc.

25